Continuous variable quantum key distribution in non-Markovian channels 
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We address continuous variable quantum key distribution (QKD) in non-Markovian lossy channels 
and show how the non-Markovian features may be exploited to enhance security and/or to detect 
the presence and the position of an eavesdropper along the transmission line. In particular, we 
suggest a coherent states QKD protocol which is secure against individual attacks for arbitrarily 
low values of the overall transmission line. Our scheme relies on specific non-Markovian properties, 
and cannot be implemented in ordinary Markovian channels characterized by uniform losses. 



PACS numbers: 03.67.Dd, 03.65.Yz,89.70.+c 

Quantum key distribution (QKD) is a fundamental 
area of quantum technology [1]. The aim of any QKD 
protocol is to allow two parties, the sender Alice and the 
receiver Bob, to exchange a secret key using quantum 
and/or classical channels, avoiding a possible eavesdrop- 
per (Eve) to acquire information on the key. Discrete 
variable QKD protocols are based on transmission and 
measurements of single or entangled photons states, and 
therefore they are limited by the efficiency of single pho- 
ton generation and detection. On the contrary, continu- 
ous variable (CV) QKD is a potentially high-bit-rate 
technique for at least two reasons. One the one hand, 
the key is encoded into continuous-spectrum quantum 
observables as the quadrature components of a light field, 
and thus the number of bits per pulse can be high. On 
the other hand, it employs homodyne detection technique 
based on standard photodiodes, which are much faster 
than the avalanche photodiodes used in photon-counting 
discrete QKD schemes. Different proposals for CV QKD 
have been put forward, either based on single-mode co- 
herent 0, |j] and sq ueezed [Bl-flU signals or EPR corre- 



lated beams [12J, [13| . Experimental demonstrations have 



been reported for coherent state [H, 0, Il3 - [l6| , squeezed 
[Toj | and EPR beams [l3[ based protocols, and uncondi- 
tional security proofs have been also given 17[. In the 
coherent state protocol, which is the most interesting for 
practical applications, Alice encodes a key into ampli- 
tudes of pure coherent states and sends them through a 
quantum channel to Bob, who randomly chooses a cod- 
ing quadrature basis in which to measure via homodyne 
detection. Binary data is extracted from the homodyne 
sample using the bit-slice reconciliation method and pri- 
vacy amplification [18[. 

The unavoidable losses occurring along the channel 
must be taken into account for a realistic description of 
any QKD protocol. In fact, it has been shown that losses 
can be exploited by eavesdroppers to hide themselves [|| . 
Security of the protocol is then defined through the equiv- 
alent noise referred to the input, i.e. on ensuring that 



the information of Bob about the key to be higher than 
the one acquired by Eve. Lossy channels considered so 
far are Markovian, i.e. characterized by a damping rate 
which is constant along the transmission line. This is 
usually an approximation and in practice channels may 
show non-Markovian losses, i.e. a damping rate which is 
not uniform along the transmission line, being dependent 
on the spectral structure of the environment coupled to 
the propagating mode lj| 2(j. Moreover, the increasing 



success of reservoir engineering techniques paves the way 
to the realization of optical channels in which the losses 
due to the interaction with the environment can be ap- 
propriately manipulated. Recently, e.g., non-Markovian 
signatures in semiconductor quantum wires have been 
experimentally observed [21] . 

In this Letter we address for the first time the effects 
of non-Markovian channel losses on the performances of 
a CV QKD protocol. In particular, we focus on the co- 
herent state protocol and show how the non-Markovian 
features may be exploited to enhance security, i.e. to re- 
duce the information available for Eve and/or to detect 
her presence and position along the transmission line. In 
our scheme, a suitable engineering of the channel decay 
rate allows us to obtain secure QKD for arbitrarily low 
values of the overall transmission line. We also show that 
the same result cannot be obtained with ordinary Marko- 
vian channels characterized by uniform losses. In the fol- 
lowing, we briefly review the coherent state protocol in a 
Markovian channel and describe the eavesdropping strat- 
egy. We then introduce a relevant class of non-Markovian 
channel and generalize the protocol to this case. Finally, 
we describe in detail our proposal to enhance security 
and show how it is possible to detect the eavesdropper 
by a post-communication comparison of part of the data 
sent by Alice to Bob. We also discuss how to optimize 
the decay properties of the channel for a specific type of 
structured environment. 

QKD using coherent states — In QKD with coher- 
ent states Alice draws pairs of indepedent real ran- 
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dom numbers (xa, Pa) from two Gaussian distributions 
with zero mean and the same variance, and then gen- 
erates the coherent states |oa) = \%a + «Pa), which are 
finally sent to Bob through a quantum channel. The 
propagation along the channel is in general noisy and 
losses are described as the interaction of the light mode 
with an environment made of a zero temperature en- 
semble of independent harmonic oscillators under the 
Born-Markov approximation [22J. The evolution is thus 
governed by a Master equation in the Lindblad form 
q = "f(2aga) — a^ag — ga^a). The state sent by Al- 
ice evolves as |oa) — > |oAe -7 *) = |o:a\A7m), where 
rj M = rj M (t) = e -27 * is the channel transmission. We 
denote by r = L (hitherto c = 1) the total transmission 
time/channel length. After the propagation Bob receives 
the damped states and arbitrarily decides to measure one 
of two orthogonal quadratures. Since the key is encoded 
in the mean value of the signal sent by Alice, he needs to 
rescale the measured observables by an amount equal to 
Vm i T )~ t t nus a l so amplifying the noise. 

Eavesdropping strategy — Due to the very nature of 
the protocol, the best passive attack Eve may perform is 
the use of an optimal asymmetric l->2 cloning machine 
23|-25|. This process can be modeled with Eve inter- 
cepting the signal with a beam splitter of transmissivity 
r] E at position L E = t E along the line. We assume Eve 
knows the features of the quantum channel (the lenght t 
and the loss rate 7) and that she can tune with arbitrary 
precision both the value of the transmissivity rj E and the 
attack time t E . The reflected part of the beam is stored 
by Eve whereas the other part is sent to Bob through a 
lossless channel. Under these conditions, the best eaves- 
dropping strategy is to attack immediately (t E = 0) with 
a beam splitter of transmissivity n E = rj M (r) Q equal to 
the overall transmissivity of the channel. In this way, Eve 
is introducing the same amount of losses as the overall 
line: Bob will receive the same state as in the absence 
of any attack and the eavesdropper is not detectable. If 
however r\ M (t) > 1/2 then, even if not detected, Eve can- 
not achieve the same information as Bob about the secret 
key and the protocol is secure 

Non-Markovian channels — Markovian evolutions are 
approximate dynamical models for channel losses and 
more realistic situations can be described with Mas- 
ter equations derived without the Markov assumption. 
As for example, including the non-resonant coupling to 
phonons in the description of propagation in fused sil- 
ica fibers, leads to delayed nonlinearity due to the non- 
Markovian phonon bath in addition to spontaneous and 
thermal noise [2(| . In the following we consider the 11011- 
Markovian master equation (NME) g — y(t)(2ap(V — 
a'ap — pat a), which corresponds to a model in which the 
light mode interacts weakly with a structured bosonic 
reservoir at zero temperature. The functional form of 
the coefficient 7(f) depends on the spectral structure of 
the environment in which the system is embedded. In 




FIG. 1: Diagram of the QKD protocol in NM channel with the 
relevant elements of Eve's attack scheme. The solid channel 
line refers to the NM channel, the dashed one refers to the 
lossless channel used by Eve. Without the eavesdropper, the 
channel is non-Mar kovian throughout its whole length. 



the weak coupling regime and for times larger than the 
typical reservoir correlation time scale t r , the coefficient 
tends to the Markovian constant value, i.e., j(t) — > j M . 
By changing the reservoir spectral properties one may 
engineer the functional form of 7(f) as well as modify 
the value of t r . It is worth noticing that the key fea- 
ture in our scheme is the inhomogeneity in the rate of 
loss 7. This can also be achieved by a suitably engi- 
neered position-dependent coupling to the reservoir along 
the optical channel, since 7(x) = j(ct). In a 11011- 
Markovian channel an initial coherent state evolves as 
\a A ) -> |a A e" r(t)/2 ) = |a A Vw) where i] NM (t) = e" 1 ^ 
is the channel transmissivity, with T(t) = 2 J Q y(s)ds. 
Because of the time dependence of the coefficient 7(t), 
we have in general T(t) $k t, i.e. the damping is not 
uniform as in the Markovian case. The eavesdropping 
strategy described above works in the same way if we let 
Eve known the analytic form of the decay rate "f(t). In 
this case, the best strategy is still to attack at the be- 
ginning of the channel and to choose properly the beam 
splitter transmissivity to have r] E = t] nm {t). In this way 
her presence is still non detectable and the results about 
the security of the channel reported in [H, 0] still hold. 
On the other hand, the time-dependent losses may be 
exploited to detect the presence of the eavesdropper and, 
in some cases, its position along the line. 

Eavesdropping detection in NM channels — One of the 
main assumptions in QKD is that everything Alice com- 
municates to Bob using public channels is also known 
by Eve. This means that, in order to detect a possi- 
ble eavesdropper, Alice needs to perform independently 
a certain operation during the transmission, leading to 
different results at Bob side when Eve is present or not. 
In our protocol, Alice still encodes the key into coherent 
signals, but now she can act on the channel length by 
adding a delay At at the first stage of the signal propa- 
gation, as depicted in Fig. [T] For the sake of simplicity, 
though we have only one physical channel, we will refer 
to the two possible choices as two channels with the same 
time-dependent loss rate 7(f) but different length. The 
key signal is always sent through the ordinary channel 



3 



of length t, but now Alice may also send a reference co- 
herent state \a ) by choosing randomly, with the same 
probability, between the ordinary and the longer channel 
of length t + At. 

Let us start by considering the situation of clean chan- 
nel (no eavesdropper) and focus to the results of the 
quadrature measurements for the reference state. Bob is 
receiving fifty percent of the time the state \a e~ v ( T ^ 2 ) 
when it is sent through the ordinary line whereas the 
rest of the copies evolve into \a e~ r ^ T+At ^ 2 ) . Since Bob 
is not aware of which channel has been chosen by Alice, 
his quadrature measurements must be independent from 
this choice. Therefore he measures quadratures scaled 
according to the total ordinary channel losses e _r ( r )/ 2 . 
After the completion of the session Alice informs Bob 
about which channel each reference state has been sent 
through. Bob can now distinguish among the two sets of 
states and study the statistics of the two measurement 
distributions. It is easy to show that these distributions 
are Gaussian with same width but they differ in the mean 
value by an amount 



8x N 



K(l- e -( r ^+ At )- r M)/ 2 )|^|a o7 (r)A^|, (1) 



where we assumed that At is small compared to the vari- 
ation of "f(t). Moreover the difference in mean value in- 
creases as the amplitude a„ increases. 

The situation changes when Eve is attacking the line. 
Because she also cannot distinguish between the refer- 
ence signals and the key ones, as well as between the 
choice of channel by Alice, she has to treat every state 
on the same foot. She then keeps unchanged the attack- 
ing time t E and the beam splitter transmissivity y/fj^. 
If she attacks at t E the transmissivity must be chosen 
in a way that e~ r ^ B ^ 2 y / r^ = e~ r ( r )/ 2 so to be unde- 
tectable when the ordinary channel is used. If Alice uses 
the longer channel Eve's attack time is forcefully shifted 
to t E + At. The same calculation as before for the differ- 
ence in the mean values of the quadrature measurement 
distribution at Bob side leads to 



Sx E = |a (l 



-(r(t E +A*)-r(t E ))/2 



)| ~ \a o7 (t E )At\ (2) 



Because of the time dependence of the loss rate j(t) the 
quantities in Eqs. (p} and ((2]) are in general different. 
Therefore, if after the communication Alice and Bob per- 
form a check of the mean values of the distributions using 
a public channel, they are able to detect the presence of 
Eve whenever 7 (is) ^ i{t). This condition cannot be 
satisfied in a Markovian channel. 

Certain types of non-Markovian channels also intro- 
duce thermal noise [271 ] ■ Since the added noise is time 



dependent, besides the mean values also the widths of 
the distributions at Bob side are different in the pres- 
ence or absence of an eavesdropper. In turn, this may 
be exploited to further enhance security via checking the 
sample variances. 




FIG. 2: (Colors online) Normalized decay rates (see text) as 
a function of time. Red lines correspond to uj c /ljo — 0.5 and 
black lines to oJc/uo = 3. uj c = 0.5 for solid lines, and uj c — 3 
for dashed lines. 



Discussion — Our proposal is based on the fact that, 
in a non-Markovian channel, T(t + s) ^ T(t) + T(s) 
for generic t, s > 0. The lack of the semigroup prop- 
erty immediately implies that the integral expression 
J t * +A * j(s)ds for fixed At is not a constant function of 
t. Therefore, the two quantities in Eqs. (JT]) and ([2]) 
do not coincide and the only way Eve can avoid de- 
tection is to attack the channel when 7(i E ) ~ t(t). 
As a consequence, it is crucial to engineer appropri- 
ately the environment surrounding the channel to ob- 
tain the desired decay properties. As a concrete ex- 
ample we consider here the decay rate evaluated for 
an Ohmic reservoir with Lorentz-Drude cutoff [28j |. i.e. 



7(*) = 7m [1 



1 cos oj t — (uj c /uj )e Uct sinoj il, w 



being the mode frequency, uj c the cut-off frequency of 
the environment spectrum, and 7m the asymptotic de- 
cay rate. The reservoir correlation time is here identified 
with t r = oj~ . 

In Fig. [2] we show the behavior of the normalized de- 
cay rate 7(i)/7 M for different values of light and cut-off 
frequencies w and uj c . The red lines are evaluated for 
the same ratio uj c /^o — 0.5 and differ for the value of 
u) c = 0.5 (solid line) and lu c — 3 (dashed line). The black 
lines instead correspond to ui c /uiq = 5 and lo c = 0.5 (solid 
line), uj c — 3 (dashed line). Decay rates of this second 
class (regime w c > o>o) are exactly what is needed for our 
scheme to work, because the relation ^{t E ) < 7 (r) holds 
for any allowed value of the attack time t E and Eve has 
in principle no way to hide herself from the security pro- 
tocol. Moreover, since for oj c > uj the function j(t) is 
invertible, Alice and Bob can also find the exact position 
of the eavesdropper along the line. On the other hand 
decay functions represented by the red lines present os- 
cillations before relaxing to the stationary value and are 
not invertible. In this case Eve may find several places 
at the beginning of the line where she can perform the 
attack while avoiding detection, i.e. when 7(ig) = 7a/. 



4 



Our detection method relies on checking whether the 
distributions of homodyne data from the two channels 
of different lengths are shifted each other by an amount 
5x NE rather than Sx E . The ability of detecting an eaves- 
dropper thus depends on the precision and the resolu- 
tion of quadrature measurements made by Bob. A fi- 
nite precision implies that Bob could not be able to 
discriminate the results when |a Ai[7(i*) — j(t)]\ < e, 
with e a threshold depending on the precision. In prac- 
tice, this means that whenever Eve places the attack 
at t E > t* E she is not revealed by our method. Ac- 
cording to Ref. Q the channel is then secure when 
r(£ B ) > - \og2ri NM , r/ NM = exp{-r(r)} being the over- 
all transmission of the non-Markovian channel. In other 
words, security is ensured if the overall transmission is 
larger than r) NM > ±exp{-r(i*)} = r} th . For any given 
e we can make t* E in principle arbitrarily close to t by 
a suitable engineering of the environment spectrum. In 
turn, this allows one to decrease the threshold and make 
the channel secure for arbitrarily low values of the over- 
all transmission ij NM . Notice also that, being t E of the 
order of the reservoir correlation time scale t h , if t r <C t 
then the amount of losses accumulated before the attack 
are negligible compared to the overall losses and the ad- 
vantage given by our protocol cannot be appreciated. In 
order to obtain a consistent improvement we need t r to 
be of the order of the total transmission time r. 

Conclusion - - We have analyzed continuous vari- 
able QKD with coherent states in the presence of non- 
Markovian effects along the transmission line and sug- 
gested a novel method to improve security based on the 
non uniform time dependence of the losses. Our method 
ensures security for arbitrarily low transmissivity of the 
channel and allows one to detect the presence and the 
position of the eavesdropper upon both a suitable engi- 
neering of the channel decay properties and the use of 
an additional reference coherent signal. The eavesdrop- 
per can manage to hide her presence by reducing the ex- 
tracted amount of information, but the legitimate users 
can reduce to zero her information by tuning the reser- 
voir correlation time. Our detection scheme is based on 
a specific non-Markovian property, and it cannot be im- 
plemented in ordinary Markovian channel characterized 
by uniform losses. Besides, since it is based on channel 
properties rather than on specific features of the distri- 
bution scheme, we foresee its application to other CV 
QKD protocols, as those based on squeezed or entangled 
states. 
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